probe-factory · multi-category results

A probe classifies whatever you can label. The question is when that beats reading the text.

We trained a separate linear probe for seven harm types on one open model's own activations, and raced each against a plain text classifier on the same data. The white-box edge is large where the harmful signal is not in the words, and vanishes where it is. That separation is the honest case for a probe.

model Qwen2.5-7B-Instruct 7 categories · real JBB + synthetic probe vs TF-IDF text classifier, same split GPU cost $0.05 run 2026-07-22

Where this applies: any open-weight model whose forward pass you control — your own or rented GPUs, or a container you ship. Not closed APIs (no activations), and not fixed managed endpoints unless the provider integrates it. Full where-it-runs map →

The scorecard

Where the white-box read wins, and where it earns nothing.

Each row: the probe's held-out AUROC (green) over the text classifier's (grey) on the same topic-matched split. The rightmost number is the gap. Categories are tagged by whether the harmful signal lives in the surface text.

probe (activations) text classifier tick = chance (0.5)

PII is the control, and it behaves as predicted. Probe 1.000 vs text 0.999 is a dead heat, because PII is in the text, so a regex-grade classifier finds it and the white-box read adds nothing. We refuse to sell probes there. The inverse is the product: on topic-matched misuse and power-seeking, the text classifier sits at chance (0.51) while the probe reads intent from activations at 0.98.

Interactive · dual-use intensity

Drag one request from benign to harmful. Watch the probe grade the intent.

This isn't a live model. These are pre-computed probe scores over a dual-use ladder: the same topic phrased at rising harmful intent. A probe doesn't flip at a keyword; it tracks intent, staying quiet through the benign and ambiguous rungs and firing when the ask turns.

benignedgierambiguousveiled harmexplicit

PASS

Aggregate over the whole ladder: mean probe score climbs 0.00 → 0.00 → 0.20 → 1.00 → 1.00 across the five intensity rungs. The graded middle is the interesting part; the probe is uncertain right where a human would be.

What the probe flagged

Surface-benign requests, caught at prefill, before a token is generated.

Redacted real examples the probe scored at the top of its range. Payloads withheld; we show only the request and the verdict. The point of the first two: nothing in the wording says "harmful," so a text filter waves them through.

Stated as plainly as the wins

What these numbers do and don't support.

The comparison is the claim, not the absolutes. Several probe AUROCs read 1.000 on small same-distribution held-out sets, which is optimistic in absolute terms. What travels is the gap to the text classifier on the identical split.
Synthetic categories are Claude-generated request prompts (deception, power-seeking, deference, fraud, harassment, PII), topic-matched harmful vs benign. Misuse uses the real JailbreakBench hard set. All labels are ours.
Deference under-delivered here (+0.008): our synthetic deference prompts carry surface tells a text classifier catches, so this run understates a cleaner test of the founder's actual research edge. Flagged, not buried.
Each probe is trained per category. This measures the method's reach, not one universal probe. Cross-category and cross-model generalization are separate open questions (see B5).

The one-line takeaway: a probe and a text classifier are measuring different things. Where intent is written in the words, they tie and you don't need us. Where intent is only in the model's head (laundered requests, power-seeking, jailbroken misuse), the probe wins by a mile. Selling the second case honestly means admitting the first.